ARTICLE 29 DATA PROTECTION WORKING PARTY

This Working Party was set up under Article 29 of Directive 95/46/EC. It is an independent European advisory body on data protection and privacy. Its tasks are described in Article 30 of Directive 95/46/EC and Article 15 of Directive 2002/58/EC.

The secretariat is provided by Directorate C (Fundamental rights and rule of law) of the European Commission, Directorate General Justice and Consumers, B-1049 Brussels, Belgium, Office No MO59 02/27

Website: http://ec.europa.eu/justice/data-protection/index_en.htm

16/EN

WP 244

Guidelines for identifying a controller or processor’s lead supervisory authority

Adopted on 13 December 2016

2

Table of Content

Identifying a lead supervisory authority: the key concepts. ................................................ 3

I. ‘Cross-border processing of personal data’. ................................................................. 3

A. ‘Substantially affects’. ............................................................................................... 3

II. Lead supervisory authority. ............................................................................................ 4

A. Main establishment. .................................................................................................. 5

1. Controllers .............................................................................................................. 5

i. Groups of undertakings. ........................................................................................... 6

ii. Borderline cases. .................................................................................................... 7

iii. Supervisory authority concerned. ........................................................................ 8

iv. Local processing. .................................................................................................... 9

v. Companies not established within the EU. .......................................................... 9

2. Processor ................................................................................................................. 9

ANNEX I - Questions to guide the identification of the lead supervisory authority ....... 11

3

Identifying a lead supervisory authority: the key concepts.

I. ‘Cross-border processing of personal data’.

Identifying a lead supervisory authority is only relevant where a controller or processor is

carrying out the cross-border processing of personal data. Article 4(23) of the General Data

Protection Regulation (GDPR) defines ‘cross-border processing’ as either the:

- processing of personal data which takes place in the context of the activities of

establishments in more than one Member State of a controller or processor in the

Union where the controller or processor is established in more than one Member

State; or

- processing of personal data which takes place in the context of the activities of a

single establishment of a controller or processor in the Union but which substantially

affects or is likely to substantially affect data subjects in more than one Member State.

This means that where an organisation has establishments in France and Romania, for

example, and the processing of personal data takes place in the context of their activities, then

this will constitute cross-border processing.

Alternatively, the organisation may only carry out processing activity in the context of its

establishment in France. However, if the activity substantially affects – or is likely to

substantially affect - data subjects in France and Romania then this will also constitute cross-

border processing.

A. ‘Substantially affects’.

The GDPR does not define ‘substantially’ or ‘affects’. The intention of the wording was to

ensure that not all processing activity, with any effect and that takes place within the context

of a single establishment, falls within the definition of ‘cross-border processing’.

The most relevant ordinary English meanings of ‘substantial’ include; ‘of ample or

considerable amount or size; sizeable, fairly large’, or ‘having solid worth or value, of real

significance; solid; weighty, important’ (Oxford English Dictionary).

The most relevant meaning of the verb ‘affect’ is ‘to influence’ or ‘to make a material

impression on’. The related noun -‘effect’- means, amongst other things, ‘a result’ or ‘a

consequence’ (Oxford English Dictionary). This suggests that for data processing to affect

someone it must have some form of impact on them. Processing with little or no effect on

individuals does not fall within the second part of the definition of ‘cross-border processing’.

However, it would fall within the first part of the definition where the processing of personal

data takes place in the context of the activities of establishments in more than one Member

State of a controller or processor in the Union, where the controller or processor is

established in more than one Member State.

Processing can be brought within the second part of the definition if there is the likelihood of

a substantial effect, not just an actual substantial effect. Note that ‘likely to’ does not mean

4

that there is a remote possibility of a substantial effect. The substantial effect must be more

likely than not. On the other hand, it also means that individuals do not have to be actually

affected: the likelihood of a substantial effect is sufficient to bring the processing within the

definition of ‘cross-border processing’.

The fact that a data processing operation may involve the processing of a number – even a

large number – of individuals’ personal data, in a number of Member States, does not

necessarily mean that the processing has, or is likely to have, a substantial effect. Processing

with little or no effect does not constitute cross-border processing for the purposes of the

second part of the definition, regardless of how many individuals it affects.

Supervisory Authorities will interpret ‘substantially affects’ on a case by case basis. We will

take into account the context of the processing, the type of data, the purpose of the processing

and factors such as whether the processing:

o causes, or is likely to cause, damage, loss or distress to individuals;

o has, or is likely to have, an actual effect in terms of limiting rights or denying an

opportunity;

o affects, or is likely to affect individuals’ health, well-being or peace of mind;

o affects, or is likely to affect individuals’ financial or economic status or

circumstances;

o leaves individuals open to discrimination or unfair treatment;

o involves the analysis of the special categories of personal or other intrusive data,

particularly the personal data of children;

o causes, or is likely to cause individuals to change their behaviour in a significant way;

o has unlikely, unanticipated or unwanted consequences for individuals; o creates embarrassment or other negative outcomes, including reputational damage; or o involves the processing of a wide range of personal data.

Ultimately, the test of ‘substantial effect’ is intended to ensure that supervisory authorities are

only required to co-operate formally through the GDPR’s consistency mechanism "where a

supervisory authority intends to adopt a measure intended to produce legal effects as regards

processing operations which substantially affect a significant number of data subjects in

several Member States”. (Recital 135)

II. Lead supervisory authority.

Put simply, a ‘lead supervisory authority’ is the authority with the primary responsibility for

dealing with a cross-border data processing activity, for example when a data subject makes a

complaint about the processing of his or her personal data.

The lead supervisory authority will coordinate any investigation, involving other ‘concerned’

supervisory authorities.

Identifying the lead supervisory authority depends on determining the location of the

controller’s ‘main establishment’ or ‘single establishment’ in the EU. Article 56 of the GDPR

says that:

- the supervisory authority of the main establishment or of the single establishment of

the controller or processor shall be competent to act as lead supervisory authority for

5

the cross-border processing carried out by that controller or processor in accordance

with the [cooperation] procedure provided in Article 60.

A. Main establishment.

Article 4(16) of the GDPR states that ‘main establishment’ means:

- as regards a controller with establishments in more than one Member State, the place

of its central administration in the Union, unless the decisions on the purposes and

means of the processing of personal data are taken in another establishment of the

controller in the Union and the latter establishment has the power to have such

decisions implemented, in which case the establishment having taken such decisions

is to be considered to be the main establishment;

- as regards a processor with establishments in more than one Member State, the place

of its central administration in the Union, or, if the processor has no central

administration in the Union, the establishment of the processor in the Union where

the main processing activities in the context of the activities of an establishment of the

processor take place to the extent that the processor is subject to specific obligations

under this Regulation;

1. Controllers

In order to establish where the main establishment is, it is firstly necessary to identify the

central administration of the data controller in the EU, if any. The approach set out in the

GDPR is that the central administration in the EU is the place where decisions about the

purposes and means of the processing of personal data are taken.

The essence of the lead authority principle in the GDPR is that the supervision of cross-

border processing should be led by only one supervisory authority in the EU. In cases where

decisions relating to different cross-border processing activities are taken within the EU

central administration, there will be a single lead supervisory authority for the various data

processing activities carried out by the multinational company. However, there may be cases

where an establishment other than the place of central administration makes autonomous

decisions concerning the purposes and means of a specific processing activity. This means

that there can be situations where more than one lead authority can be identified, i.e. in cases

where a multinational company decides to have separate decision making centres, in different

countries, for different processing activities.

In these situations it will be essential for companies to identify precisely where the decisions

on purpose and means of processing are taken. Correct identification of the main

establishment is in the interests of controllers and processors because it provides clarity in

terms of which supervisory authority they have to deal with in respect of their various

compliance duties under the GDPR. These include registering a data protection officer;

notifying a risky processing activity or notifying a data security breach. The relevant

provisions of the GDPR are intended to make these compliance tasks manageable.

The examples below illustrate this:

6

Example 1: A food retailer has its headquarters (i.e. its ‘place of central administration’) in

Rotterdam, Netherlands. It has establishments in various other EU countries, which are in

contact with individuals there. All establishments make use of the same software to process

consumers’ personal data for marketing purposes. All the decisions about the purposes and

means of the processing of consumers’ personal data for marketing purposes are taken within

its Rotterdam headquarters. This means that the company’s lead supervisory authority for this

cross border processing activity is the Netherlands supervisory authority.

Example 2: A bank has its corporate headquarters in Frankfurt, and all1 its banking

processing activities are organised from there, but its insurance department is located in

Vienna. If the establishment in Vienna has the power to decide on all insurance data

processing activity and to implement these decisions for the whole EU, then as foreseen in

Art 4(16) of the GDPR, the Austrian supervisory authority would be the lead authority in

respect of the cross border processing of personal data for insurance purposes, and the

German authorities (Hessen supervisory authority) would supervise the processing of

personal data for banking purposes, wherever the clients are located. 2

i. Groups of undertakings.

Where processing is carried out by a group of undertakings that has its headquarters in the

EU, the establishment of the undertaking with overall control should be considered to be the

main establishment for the group, except where the purposes and means of processing are

determined by another establishment. The parent, or operational headquarters of the group of

undertakings in the EU, is likely to be the main establishment, because that would be the

place of its central administration.

The reference in the definition to the place of a controller’s central administration works well

for organisations that have a centralised decision-making headquarters and branch-type

structure. In such cases it is clear that the power to make decisions about cross-border data

processing, and to have them carried out, lies within the company’s headquarters. In such

cases, determining the location of the main establishment – and therefore which supervisory

authority is the lead supervisory authority - is straightforward. However, the decision system

of group of companies could be more complex, giving independent making powers relating to

cross border processing to different establishments.

Criteria for identifying the main establishment in cases where it is not the place of its

central administration in the EU.

Recital 36 of the GDPR is useful in clarifying the main factor that shall be used to determine

a controller’s main establishment if the criterion of the central administration does not apply.

1 In the context of processing personal data for banking purposes, we recognise that are many different

processing activities involved in this. However, to simplify matters, we address all of them as a single purpose.

The same is true of processing done for insurance purposes. 2 It should be recalled also that the GDPR provides for the possibility of local oversight in specific cases. See

Recital (127): “Each supervisory authority not acting as the lead supervisory authority should be competent to

handle local cases where the controller or processor is established in more than one Member State, but the subject

matter of the specific processing concerns only processing carried out in a single Member State and involves only

data subjects in that single Member State, for example, where the subject matter concerns the processing of

employees' personal data in the specific employment context of a Member State.” This principle means that the

supervision of HR data connected to local employment context could fall to several supervisory authorities.

7

This involves identifying where the effective and real exercise of management activities, that

determine the main decisions as to the purposes and means of processing through stable

arrangements, takes place. Recital 36 also clarifies that “the presence and use of technical

means and technologies for processing personal data or processing activities do not, in

themselves, constitute a main establishment and are therefore not determining criteria for a

main establishment”.

The data controller itself identifies where its main establishment is and therefore which

supervisory authority is its lead authority. However, this can be challenged by the respective

supervisory authority concerned afterwards.

The factors below are useful for determining the location of a controller’s main

establishment, according to the terms of the GDPR, in cases where it is not the location of its

central administration in the EU.

o Where are decisions about the purposes and means of the processing given final ‘sign

off’?

o Where are decisions about business activities that involve data processing made?

o Where does the power to have decisions implemented effectively lie?

o Where is the Director (or Directors) with overall management responsibility for the

cross border processing located?

o Where is the controller or processor registered as a company, if in a single territory?

Note that this is not an exhaustive list. Other factors may be relevant depending on the

controller or processing activity in question. If a supervisory authority has reasons to doubt

that the establishment identified by the controller is in reality the main establishment for the

purposes of the GDPR, it can – of course – require the controller to provide the additional

information necessary for it to prove where its main establishment is located.

ii. Borderline cases.

There will be borderline and complex situations where it is difficult to identify the main

establishment or to determine where decisions about data processing are taken. This might be

the case where there is cross-border processing activity and the controller is established in

several Member States, but there is no central administration in the EU and none of the EU

establishments are taking decisions about the processing (i.e. decisions are taken exclusively

outside of the EU).

In the case above, the company carrying out cross border processing may be keen to be

regulated by a lead authority to benefit from the One-Stop-Shop principle. However, the

GDPR does not provide a solution for situations like this. In these circumstances, the

pragmatic way to deal with this would be for the company to designate the establishment that

will act as its main establishment. This establishment must have the authority to implement

decisions about the processing activity and to take liability for the processing, including

having sufficient assets. If the company does not designate an establishment in this way, it

will not be possible to designate a lead authority. Supervisory authorities will always be able

to investigate further where this is appropriate.

The GDPR does not permit ‘forum shopping’. If a company claims to have its main

establishment in one Member State, but no effective and real exercise of management activity

8

or decision making over the processing of personal data takes place there, the relevant

supervisory authorities (or ultimately EDPB) will decide which supervisory authority is the

‘lead’, using objective criteria and looking at the evidence. The process of determining where

the main establishment is may require active inquiry and co-operation by the supervisory

authorities. Conclusions cannot be based solely on statements by the organisation under

review. The burden of proof ultimately falls on controllers and processors. They should be

able to demonstrate to supervisory authorities where decisions about data processing are

actually taken and implemented. Effective records of data processing activity would help

both organisations and supervisory authorities to determine the lead authority.

In some cases the relevant supervisory authorities will ask the controller to provide clear

evidence, in line with any EDPB guidelines, of where its main establishment is, or where

decisions about a particular data processing activity are taken. This evidence will be given

due weight and the supervisory authorities involved will co-operate to decide which one of

them will take the lead in investigations. Such cases will only be referred to the EDPB for a

decision under Article 65(1)(b) where supervisory authorities have conflicting views in terms

of identifying the lead supervisory authority. However, in most cases, we expect that the

relevant supervisory authorities will be able to agree a mutually satisfactory course of action.

iii. Supervisory authority concerned.

GDPR Article 4(22) says that:

‘supervisory authority concerned’ means a supervisory authority which is concerned

by the processing of personal data because: (a) the controller or processor is

established on the territory of the Member State of that supervisory authority; (b)

data subjects residing in the Member State of that supervisory authority are

substantially affected or likely to be substantially affected by the processing; or (c) a

complaint has been lodged with that supervisory authority.

The concept of a concerned supervisory authority is meant to ensure that the ‘lead authority’

model does not prevent other supervisory authorities having a say in how a matter is dealt

with when, for example, individuals residing outside the lead authority’s jurisdiction are

substantially affected by a data processing activity. In terms of factor (a) above, the same

considerations as for identifying a lead authority apply. Note that in (b) the data subject must

merely reside in the Member State in question; he or she does not have to be a citizen of that

state. It will generally be easy – in (c) to determine – as a matter of fact – whether a particular

supervisory authority has received a complaint.

Article 56, paragraphs (2) and (5) of the GDPR provide for a concerned supervisory authority

to take a role in dealing with a case without being the lead supervisory authority. When a

lead supervisory authority decides not to handle a case, the concerned supervisory authority

that informed the lead shall handle it.. This is in accordance with the procedures in Article 61

(Mutual assistance) and Article 62 (Joint operations of supervisory authorities) of the GDPR.

This might be the case where a marketing company with its main establishment in Paris

launches a product that only affects data subjects residing in Portugal. In such a case the

French and Portuguese supervisory authorities might agree that it is appropriate for the

Portuguese supervisory authority to take the lead in dealing with the matter. Given that the

processing activity has a purely local effect – i.e. on individuals in Portugal – the French and

9

Portuguese supervisory authorities have the discretion to decide which supervisory authority

should deal with the matter – in accordance with Recital 127.

The GDPR requires lead and concerned supervisory authorities to co-operate, with due

respect for each other’s views, to ensure a matter is investigated and resolved to each

authority’s satisfaction – and with an effective remedy for data subjects. Supervisory

authorities should endeavour to reach a mutually acceptable course of action. The formal

consistency mechanism should only be invoked where co-operation does not reach a mutually

acceptable outcome.

The mutual acceptance of decisions can apply to substantive conclusions, but also to the

course of action decided upon, including enforcement activity (e.g. full investigation,

investigation with limited scope, a warning or a press statement). It can also apply to a

decision not to handle a case in accordance with GDPR, for example because of a formal

policy of prioritisation, or because there are other concerned authorities as described above.

The development of consensus and good will between supervisory authorities is essential to

the success of the GDPR’s cooperation and consistency process.

iv. Local processing.

Local data processing activity does not fall within the GDPR’s cooperation and consistency

provisions. Supervisory authorities will respect each other’s competence to deal with local

data processing activity on a local basis. (Processing carried out by public authorities will

always be dealt with on a ‘local’ basis too.)

v. Companies not established within the EU.

The GDPR’s cooperation and consistency mechanism only applies to controllers with an

establishment, or establishments, within the European Union. If the company does not have

an establishment in the EU, the mere presence of a representative in a Member State does not

trigger the one stop shop system. This means that controllers without any establishment in the

EU must deal with local supervisory authorities in every Member State they are active in,

through their local representative.

2. Processor

GDPR also offers the one stop shop system for the benefit of data processors that are subject

to GDPR and have establishments in more than one Member State.

Article 4(16)(b) of the GDPR states that the processor’s main establishment will be the place

of the central administration of the processor in the EU or, if there is no central

administration in the EU, the establishment in the EU where the main processing (processor)

activities take place.

However, according to Recital 36, in cases involving both controller and processor, the

competent lead supervisory authority should be the lead supervisory authority for the

controller. In this situation, the supervisory authority of the processor will be a ‘supervisory

authority concerned’ and should participate in the cooperation procedure. This rule will only

10

apply where the controller is established in the EU. In cases when controllers are subject to

the GDPR on the basis of Art 3.2, they will not be subject to the one stop shop mechanism.

11

ANNEX I - Questions to guide the identification of the lead supervisory authority

I. Is the controller or processor carrying out cross-border data processing?

a. Yes, because it is established in one single Member State and processes personal data in

the context of that single establishment in the EU, but the processing substantially affects or

is likely to substantially affect individuals in more than one Member State.

In this case, the lead authority is the one of the single establishment in the single

Member State, which is the processor and/or controller’s main establishment by

definition.

b. Yes, because the processor and/or controller is established in more than one MS and

processes personal data in the context of the activities of (at least some) of those

establishments.

For this case, go to section II.

II. Identify the lead supervisory authority

In context of 1) b; does the case involve a controller or a processor?

a. In case of involving only a controller, the controller identifies the place of central

administration in the EU,

i. competence of supervisory authority of that country as lead for data processing under

review.

ii. unless the decisions on purposes and means of the processing are taken in another

establishment in the EU: lead authority attached to that place in the EU.

b. If the case involves a controller and a processor:

i. Check if the controller is established in the EU and subject to the one stop shop system

ii. Identify the location of the lead supervisory authority of the controller, which will serve

as the lead supervisory authority for both controller and processor

iii. consider the supervisory authority competent for the processor as a concerned authority.

c. If the cases involves only a Processor

i. identify the place of central administration in the EU

ii. If no central administration in the EU, identify the establishments in the EU in the context

of which the data processing take place and determine where the main processing activities

take place

III. Identify the concerned supervisory authorities

Which other supervisory authorities are ‘concerned’ authorities?

An authority may be ‘concerned’ when there is an establishment of the controller/processor

on its territory OR when data subjects on its territory are substantially or likely to be

substantially affected OR when a complaint is received.

1

WP244 ANNEX II – Frequently Asked Questions

What is a lead supervisory authority?

In the GDPR, the general rule is that the supervision of cross-border processing activity, or

involving citizens of, more than one EU country, is led by only one supervisory authority,

called the Lead supervisory authority. This is known as the One Stop Shop principle.

A lead supervisory authority is the body with the primary responsibility for dealing with a

cross-border processing activity, for example when a company carrying out processing

activity in several Member States is being investigated.

The lead authority will coordinate operations involving supervisory authorities concerned, in

accordance with Articles 60-62 of the Regulation (e.g. one stop shop, mutual assistance, and

joint operations). It will submit any draft decision to those supervisory authorities with an

interest in the matter.

What is cross-border processing?

The lead supervisory authority mechanism is only triggered in the context of cross-border

processing. Therefore it is necessary to identify whether any cross-border processing is being

carried out.

According to Article 4(23) of the Regulation ‘cross-border processing’ means either the:

- processing of personal data which takes place in the context of the activities of

establishments in more than one Member State of a controller or processor in the

Union where the controller or processor is established in more than one Member State;

or

- processing of personal data which takes place in the context of the activities of a single

establishment of a controller or processor in the Union but which substantially affects

or is likely to substantially affect data subjects in more than one Member State.

What does ‘substantially affect’ mean?

The regulation does not define ‘substantially affect’.

Supervisory Authorities will interpret ‘substantially affects’ on a case by case basis. We will

take into account the context of the processing, the type of data, the purpose of the processing

and factors such as whether the processing:

- causes, or is likely to cause, damage, loss or distress to individuals;

- has, or is likely to have, an actual effect in terms of limiting rights or denying an

opportunity;

- affects, or is likely to affect individuals’ health, well-being or peace of mind;

- affects, or is likely to affect individuals’ financial or economic status or circumstances;

- leaves individuals open to discrimination or unfair treatment;

- involves the analysis of the special categories of personal or other intrusive data,

particularly the personal data of children;

- causes, or is likely to cause, individuals to change their behaviour in a significant way;

- has unlikely, unanticipated or unwanted consequences for individuals;

2

- creates embarrassment or other negative outcomes, including reputational harm, or

- involves the processing of a wide range of personal data.

How is the lead supervisory authority for Controller identified?

Once it has been determined that the processing in question is cross-border processing, then

the lead supervisory authority must be identified.

According to Article 56 of the Regulation, the supervisory authority of the country where the

main establishment of the organisation is based will be the lead authority.

Where an organization has a single establishment in the EU, but the processing substantially

affects or is likely to substantially affect data subjects in more than one Member State, the

lead supervisory authority is the supervisory authority of the place of that single

establishment.

Where an organisation has several establishments in the EU, the principle is that the main

establishment is the place of the central administration of that organisation. However, if

another establishment takes the decisions about the purposes and means of the processing -

and has the power to have such decisions implemented – then that becomes the main

establishment. It is up to data controllers to establish clearly where decisions on the purposes

and means of personal data processing activities are being made.

As an illustration, if a company carries out one or several cross-border processing activities

and decisions concerning all the cross-border processing are taken within the EU central place

of administration, there will be one single lead supervisory authority for all the cross-border

processing activity. This will be the supervisory authority of the place of the company’s

central administration.

However, if a company carries out several cross-border processing activities and the decisions

on the means and purposes of processing are taken in different establishments, there will be

more than one lead supervisory authority. These will be the authorities of the place of the

establishments taking the decisions on the respective cross-border processing activities. To

fully benefit from the one stop shop mechanism with a single lead supervisory authority for

all cross-border processing, companies should consider organising decision-making powers in

respect of personal data processing activities in a single location.

What criteria are used to identify the Controller’s lead supervisory authority?

The factors below are useful for determining the location of a controller’s main establishment:

- Does it have a single establishment in the EU?

If so, and if the processing substantially affects or is likely to substantially affect data

subjects in more than one Member State, the lead supervisory authority is the

supervisory authority of the place of that single establishment.

- Does it have an EU headquarters?

o If so, what is its role and are decisions about the purposes and means of the

processing taken within this establishment and does this establishment have the

power to implement decisions concerning the processing activity?

3

o If not, are there other establishments where:

decisions about business activities that involve data processing are

made?

the power to have decisions implemented effectively lie?

the Director (or Directors) with overall management responsibility for

the cross-border processing activity is located?

the controller or processor is registered as a company, if in a single

territory?

How is the lead supervisory authority for processors identified?

The Regulation also allows data processors that are subject to Regulation, and have

establishments in more than one Member State, to benefit from the one-stop-shop system.

Article 4(16)(b) provides that the processor’s main establishment will be the place of the

central administration of the processor in the EU or, if there is no central administration in the

EU, the establishment in the EU where the main processing (processor) activities take place.

However, according to Recital 36, in cases involving both controller and processor, the

competent lead supervisory authority will be the one for the controller. In this situation, the

supervisory authority of the processor is considered a ‘supervisory authority concerned’ and

should participate in the cooperation procedure.